Secure Authentication System (JEE)

A comprehensive, enterprise-grade authentication system built with Jakarta EE technologies. This application demonstrates secure user management, password recovery via email, and robust session handling.

🚀 Features

Core Authentication

• ✅ User registration with validation
• ✅ Secure login with BCrypt password hashing
• ✅ Session-based authentication
• ✅ Remember me functionality
• ✅ Logout with session cleanup

Password Management

• 🔐 Secure password hashing with BCrypt
• 📧 Email-based password reset with 6-digit verification codes
• 🔒 Password change functionality
• 📋 Password requirements enforcement

User Features

• 👤 User profile management
• ✏️ Profile editing capabilities
• 📊 Protected dashboard with authentication filter
• 🎨 Responsive, modern UI design

Security Features

• 🛡️ CSRF protection considerations
• 🚫 Input validation and sanitization
• 🔒 Session timeout management (15 minutes for password reset)
• 📋 Security constraints configuration
• 🔐 Secure cookie configuration (HTTP-only)

🏗️ Technology Stack

Backend

• Jakarta EE 10 - Enterprise Java framework
• Servlet API 6.0 - Web component development
• JSP 3.1 - Dynamic web pages
• JSTL - JSP Standard Tag Library
• Hibernate 6.4 - ORM for database operations
• PostgreSQL - Primary database
• Redis - Session storage and caching
• JavaMail - Email functionality

Frontend

• HTML5/CSS3 - Modern responsive design
• Vanilla JavaScript - Client-side interactions
• JSP Templates - Server-side rendering

Build & Deployment

• Apache Maven - Dependency management and build automation
• Docker & Docker Compose - Containerization
• Apache Tomcat 10.1 - Application server
• C3P0 - Database connection pooling

Development Tools

• Lombok - Code generation
• SLF4J - Logging framework
• JUnit - Testing framework

📋 Prerequisites

• Java 17 or higher
• Maven 3.6+
• Docker & Docker Compose
• PostgreSQL (or use the provided Docker setup)
• Redis (or use the provided Docker setup)
• Gmail account with App Password (for email functionality)

🚀 Quick Start

1. Clone the Repository

git clone <repository-url>
cd authapp2

2. Configure Email (Required for password reset)

Create a .env file with your Gmail credentials:

# Generate App Password at: https://myaccount.google.com/apppasswords
SMTP_USERNAME=your-email@gmail.com
SMTP_PASSWORD=your-16-digit-app-password
FROM_EMAIL=your-email@gmail.com

3. Start with Docker Compose

docker-compose up -d

4. Access the Application

• Application: http://localhost:8080
• Login: http://localhost:8080/login
• Register: http://localhost:8080/register
• Forgot Password: http://localhost:8080/forgot-password

📁 Project Structure

authapp2/
├── src/main/
│   ├── java/com/auth/
│   │   ├── dao/           # Data Access Objects
│   │   ├── model/         # Entity classes
│   │   ├── servlet/       # HTTP request handlers
│   │   ├── filter/        # Security filters
│   │   ├── service/       # Business logic
│   │   └── util/          # Utility classes (Password, Email)
│   ├── webapp/
│   │   ├── WEB-INF/
│   │   │   ├── views/     # JSP pages
│   │   │   └── web.xml    # Deployment descriptor
│   │   └── css/           # Stylesheets
│   └── resources/
│       ├── META-INF/      # JPA configuration
│       └── email.properties # Email settings template
├── docker/
│   └── Dockerfile         # Application container
├── docker-compose.yml      # Multi-container setup
├── pom.xml               # Maven configuration
├── .env.example          # Environment variables template
└── README.md             # This file

🔧 Configuration

Database Configuration

The application uses PostgreSQL with connection pooling. Database settings are configured in:

• src/main/resources/META-INF/persistence.xml - JPA configuration
• docker-compose.yml - Docker database setup

Email Configuration

Email functionality uses Gmail SMTP. Configure in:

• .env file (recommended) or
• src/main/java/com/auth/util/EmailUtil.java

Security Configuration

Security settings are in src/main/webapp/WEB-INF/web.xml:

• Session timeout: 30 minutes
• Password reset timeout: 15 minutes
• Transport guarantee: Configurable (HTTP/HTTPS)

📧 Email Setup Guide

Gmail Configuration

1. Enable 2-Step Verification on your Gmail account
2. Visit Google App Passwords
3. Generate a new app password:
   • Select app: "Mail"
   • Select device: "Other" → "AuthApp"
4. Use the 16-character password in your .env file

Alternative Email Providers

Update EmailUtil.java with your SMTP provider settings:

SMTP_HOST = "smtp.your-provider.com"
SMTP_PORT = "587"  // or appropriate port

🐳 Docker Deployment

The application is fully containerized with:

Services

• tomcat: Application server (port 8080)
• postgres: PostgreSQL database (port 5432)
• redis: Redis cache (port 6379)

Commands

# Start all services
docker-compose up -d

# View logs
docker-compose logs -f tomcat

# Stop services
docker-compose down

# Rebuild after changes
mvn clean package && docker-compose up -d --build

🧪 Testing

Manual Testing

1. Registration: Create a new user account
2. Login: Test authentication functionality
3. Password Reset: Test email verification flow
4. Profile Management: Edit user profile
5. Session Management: Test session timeout

Automated Testing

# Run all tests
mvn test

# Run specific test class
mvn test -Dtest=UserServiceTest

🔒 Security Considerations

Implemented

• ✅ Password hashing with BCrypt
• ✅ Session timeout management
• ✅ Input validation
• ✅ SQL injection protection via JPA/Hibernate
• ✅ XSS protection via JSP escaping
• ✅ Email verification for password reset

Production Recommendations

• 🔄 Enable HTTPS (change transport-guarantee to CONFIDENTIAL)
• 🔑 Use environment variables for sensitive data
• 🛡️ Implement rate limiting
• 📝 Add comprehensive logging and monitoring
• 🔐 Set up CSP headers
• 🌐 Configure reverse proxy (Nginx/Apache)

📊 Database Schema

Users Table

CREATE TABLE users (
    id SERIAL PRIMARY KEY,
    username VARCHAR(50) UNIQUE NOT NULL,
    email VARCHAR(100) UNIQUE NOT NULL,
    password VARCHAR(255) NOT NULL,
    full_name VARCHAR(50),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

🚀 API Endpoints

Public Endpoints

• GET / - Welcome page
• GET /login - Login form
• POST /login - Process login
• GET /register - Registration form
• POST /register - Process registration
• GET /forgot-password - Forgot password form
• POST /forgot-password - Send reset code
• GET /reset-password - Reset password form
• POST /reset-password - Process password reset

Protected Endpoints (Authentication Required)

• GET /dashboard - User dashboard
• GET /profile - View profile
• GET /edit-profile - Edit profile form
• POST /edit-profile - Update profile
• GET /change-password - Change password form
• POST /change-password - Update password
• POST /logout - Logout

🐛 Troubleshooting

Common Issues

Email Not Sending

• Check Gmail app password configuration
• Ensure 2-Step Verification is enabled
• Verify SMTP settings in .env file

Database Connection Issues

• Verify PostgreSQL is running: docker ps | grep postgres
• Check database credentials in docker-compose.yml
• Review persistence.xml configuration

Application Not Starting

• Check Docker logs: docker logs auth-tomcat
• Verify WAR file exists in target/ directory
• Check for port conflicts (8080)

Session Issues

• Clear browser cookies and session data
• Check Redis connection if using external session storage
• Review session timeout configuration

📝 Development Guide

Adding New Features

1. Create/update servlets in src/main/java/com/auth/servlet/
2. Add JSP views in src/main/webapp/WEB-INF/views/
3. Update security filters if needed
4. Add DAO methods for database operations

Code Style

• Follow Java naming conventions
• Use Lombok for boilerplate code reduction
• Maintain separation of concerns (DAO → Service → Servlet)
• Add proper logging and error handling

🤝 Contributing

1. Fork the repository
2. Create a feature branch: git checkout -b feature/new-feature
3. Commit changes: git commit -m 'Add new feature'
4. Push to branch: git push origin feature/new-feature
5. Submit a pull request

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• Jakarta EE community for the enterprise framework
• Spring Security inspiration for authentication patterns
• BCrypt library for secure password hashing
• Docker community for containerization tools
• Bootstrap and modern CSS frameworks for UI inspiration

---

Note: This is an educational project demonstrating enterprise Java patterns. For production deployment, ensure all security configurations are properly hardened.